Note: This question is about the package manifest file (NOT the bucket manifest file).
Scenario: I accidentally deleted my package manifest files after upgrading between versions.
e.g. Upgraded from version 6.4.1 to 6.4.3.
Install directory = /opt/splunk
Action = I accidentally deleted both manifest from splunk-6.4.1-somenumbers-linux-2.6-x86_64-manifest and splunk-6.4.3-somenumbers-linux-2.6-x86_64-manifest from /opt/splunk/
Error: I am now getting error of this form when I start splunk;
"Cannot find any course of hashes. Manifest file '(null)' not present?"
How can I regenerate these?
Workaround: If use the same install package (e.g. 6.4.3) used in upgrade, install in a temp area. Then, just grab the manifest file in the temp area. It should be the same as the one you want to recover.
Example:
-Your "live" instance (i.e. the one you deleted the file from) is in /opt/splunk
-Install a "new" instance to /opt/splunk2
-Grab the manifest file from /opt/splunk2, copy it into /opt/splunk
-Start /opt/splunk and observe error goes away and is replaced with message of the form:
"Validating installed files against hashes from '/opt/splunk/splunk-versionnumber-ID-platform-manifest'. All installed files intact"
Workaround: If use the same install package (e.g. 6.4.3) used in upgrade, install in a temp area. Then, just grab the manifest file in the temp area. It should be the same as the one you want to recover.
Example:
-Your "live" instance (i.e. the one you deleted the file from) is in /opt/splunk
-Install a "new" instance to /opt/splunk2
-Grab the manifest file from /opt/splunk2, copy it into /opt/splunk
-Start /opt/splunk and observe error goes away and is replaced with message of the form:
"Validating installed files against hashes from '/opt/splunk/splunk-versionnumber-ID-platform-manifest'. All installed files intact"